Cyber Security | Web Development

 Activity & Services using ADB Shell:  Using Drozer - Exploit the Content Providers  Exploit SharedPreference using adb shell SQLite Databases using ADB Local Storage using ADB DROZER Content Provider by using Drozer Broadcast and Receiver

  Exploitability Metrics Attack Vector(AV) Network (N) – The attacker can exploit the vulnerability remotely over the internet . (Highest Severity) Example: Exploiting a web server via a crafted HTTP request. Adjacent Network (A) – The attacker must be on the same local network segment . (High Severity) Example: Attacking a router using vulnerabilities available only on the same Wi-Fi network. Local: Needs access to the operating system , not the device. (Medium Severity) Example: Running a malicious program after login. Physical: Needs hands-on access to the device.   (Lowest Severity) Example: Plugging in a malicious USB.  Attack Complexity: Scanerio: We have one network environment that is easily exploitable. Hence, the attack complexity is chosen to be LOW . Scenario 2: We have one network environment that is hard to exploit. Hence, the attack complexity is chosen to HIGH . 🔐 Privilege Required (PR) Levels 1️⃣ PR: None (N) Attacker needs no login or a...

1.  Weak Credential Management vulnerability http://172.19.0.3:5000/dashboard Credential: admin:admin123 2. Sensitive Information Disclosure 3. SQL Injection Payload : ' OR 1=1 -- 4. JWT Weak Implementation Missing Input Validation in Loan Request Verify the input field length validation: Input : -5000 Input: 999999999999999999 Input: 0 The above input values are should not be allow to use in the application.

 Server Side Request Forgery (SSRF) App - 2

Excessive Data Exposures: Disclose the sensitive information in the endpoints such as Email ID, Contact numbers and etc.

  What is Mass Assignment? (Easy Explanation) Mass assignment happens when an API automatically takes all the data sent by the user and assigns it directly to a database model without filtering which fields are allowed . This becomes dangerous because a malicious user can send extra fields that they should not have control over. ❌ Why is Mass Assignment Dangerous? Because attackers can modify sensitive fields that were never meant to be changed — such as: role (e.g., make themselves admin) isActive balance isPaid password isAdmin Simple Example Bad API Code (Vulnerable to mass assignment) Imagine we have a User model: // User model fields {   name: String,   email: String,   role: String, // "user" or "admin"   isActive: Boolean } And the API endpoint: // ❌ Dangerous app.post('/users', async (req, res) => {   const user = await User.create(req.body); // ← mass assignment   res.send(user); }); Normally, a user should only set...